SUSE-SU-2022:3347-1

Details

Description of the patch:

This update for rubygem-rack fixes the following issues:

CVE-2020-8184: Fixed vulnerability where percent-encoded cookies can be used to overwrite existing prefixed cookie names (bsc#1173351).
CVE-2020-8161: Fixed directory traversal in Rack:Directory (bsc#1172037).

Affected Packages

ruby2.5-rubygem-rack

SUSE Linux Enterprise High Availability Extension 15SUSE Linux Enterprise High Availability Extension 15 SP1SUSE Linux Enterprise High Availability Extension 15 SP2SUSE Linux Enterprise High Availability Extension 15 SP3SUSE Linux Enterprise High Availability Extension 15 SP4

Fixed in:

2.0.8-150000.3.9.1

ruby2.5-rubygem-rack-doc

openSUSE Leap 15.3openSUSE Leap 15.4

Fixed in:

2.0.8-150000.3.9.1

ruby2.5-rubygem-rack-testsuite

openSUSE Leap 15.3openSUSE Leap 15.4

Fixed in:

2.0.8-150000.3.9.1

References

ADVISORY